Hybrid Botnet Detection Mechanism

Botnets have emerged as one of the biggest threats to internet security in the recent years. They have confounded security researchers because of their mobile and secretive behavior. A Botnet is a network of zombie machines remotely controlled by a command server or a Botmaster. These compromised host machines may be used for sending spam, launching DOS attacks, spying or stealing information. As botnets have evolved, so has the detection techniques changed. A number of different techniques have been suggested yet no technique is completely foolproof. While some are based on detecting anomalies, others focus on DNS queries [Choi et al., 2007] or DNSBL [Ramachandran et al., 2006] queries etc. This paper analyzes layouts of different detection techniques. The paper tries to find features that, when combined together, complement each other’s strengths and eliminate the weaknesses and suggests a framework consisting of a combination of those features which, theoretically, should overcome most of the common problems faced by detection techniques. General Terms Botnets, Detection techniques, Security threat, Networks, hybrid botnets